Don't return null from ReplaceSelectionCommand::insertAsListItems()

Source/core/editing/ReplaceSelectionCommand.cpp

Index: Source/core/editing/ReplaceSelectionCommand.cpp
diff --git a/Source/core/editing/ReplaceSelectionCommand.cpp b/Source/core/editing/ReplaceSelectionCommand.cpp
index 8b8f99f1294b1b0e365e04c3fd0b0dbcf2b34957..e2b72706ee512e44ad29c380b01416e4cd2e9ceb 100644
--- a/Source/core/editing/ReplaceSelectionCommand.cpp
+++ b/Source/core/editing/ReplaceSelectionCommand.cpp
@@ -1082,7 +1082,7 @@ void ReplaceSelectionCommand::doApply()
     }
 
     // Mutation events (bug 22634) may have already removed the inserted content
-    if (!refNode->inDocument())
+    if (!refNode || !refNode->inDocument())

[Yuta Kitamura, 2014/04/02 09:34:49]

nit: Test for |!refNode| should probably be done right after
insertAsListItems(), since transformation into null can only
happen in the first "if" block.

[yosin_UTC9, 2014/04/03 05:01:50]

Done.

         return;
 
     bool plainTextFragment = isPlainTextMarkup(refNode.get());